{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"4.2511.0"}],"component":"github.com/actiontech/sqle","cve_ids":["CVE-2025-15107"],"ecosystem":"Go","epss":0.00618,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-43h9-hc38-qph5","id":"tcs_01M5KEVQ7N0DT4CKXDT4BW0F8E","modified_at":"2026-02-03T03:14:44.181446Z","published_at":"2025-12-27T15:30:17Z","references":["https://osv.dev/vulnerability/GHSA-43h9-hc38-qph5","https://nvd.nist.gov/vuln/detail/CVE-2025-15107","https://github.com/actiontech/sqle/issues/3186","https://github.com/actiontech/sqle","https://github.com/actiontech/sqle/blob/4714f83f33e0d7aa647036eb756e928aa4174014/sqle/utils/jwt.go#L9","https://github.com/actiontech/sqle/milestone/53","https://vuldb.com/?ctiid.338478","https://vuldb.com/?id.338478","https://vuldb.com/?submit.710380"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-43h9-hc38-qph5","url":"https://osv.dev/vulnerability/GHSA-43h9-hc38-qph5"}],"summary":"SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key"}